Health and Safety Due Diligence in M&A: 6 Red Flags That Change the Deal
Financial, legal, tax and technology diligence get weeks. Health and safety usually gets a single line in the disclosure schedule and a warranty nobody expects to rely on. Then completion happens, the acquiring group inherits the target's entire history of undocumented exposure, and the first anyone hears about it is when an inspector arrives or a claim lands two years later.
In a share purchase this matters more than most buyers assume. Buy the assets and you can often leave the liability behind. Buy the company and you buy its regulatory history intact: the improvement notice from 2023, the risk assessments nobody has updated since the office move, the German subsidiary that has never produced the document its own law requires. None of that appears in the financial model, and all of it is chargeable to the new owner.
These are the six things worth looking for. Each is cheap to check before signing and expensive to discover afterwards.
1. Risk assessments that predate the current premises
Start with dates, not content. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires a suitable and sufficient assessment, reviewed when circumstances change. A target that has moved offices, doubled headcount or shifted to hybrid working since its last assessment does not have a current one, whatever the data room index says.
The tell is a set of documents all created in the same week, usually shortly before a previous funding round or a previous sale process. That pattern means the paperwork was produced to satisfy a buyer rather than to manage a risk, and the underlying arrangements were never built. Ask when each assessment was last reviewed and what triggered the review.
2. Incident records that look implausibly clean
A professional services business with 200 staff and no recorded incidents across three years is not exceptionally safe. It is not recording. Slips, manual handling strains and display screen complaints occur at predictable rates in every office population, and their total absence from a register indicates the register is not being used.
This matters because RIDDOR creates reporting duties with defined timeframes, and a pattern of non-reporting is itself an offence separate from whatever caused the injury. It also removes the buyer's ability to price the risk, because there is no trend data to price. Request the raw incident log rather than a summary, and compare its shape against your own portfolio.
3. Enforcement history the seller has not volunteered
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
Improvement notices and prohibition notices issued in Great Britain are published by the HSE on its public enforcement register, which anyone can search by company name, alongside an equivalent database of prosecutions. Neither requires the seller's cooperation.
Search the target and every trading subsidiary before you send the diligence questionnaire, not after. A notice the seller failed to disclose is a warranty issue and a negotiating position. A notice they did disclose, properly closed out with evidence, is reassuring and worth crediting. Extend the search to the regulators in every country the target operates in, because a UK-clean record says nothing about the Milan office.
4. Overseas entities with no local statutory instrument
The most commonly missed item, and the one that most often turns out to be material. Sellers assemble UK-centric data rooms. A group operating across Europe carries obligations that are not satisfied by a UK-format document, however thorough.
A German entity requires a documented Gefährdungsbeurteilung and sits within the DGUV framework. A French entity requires a DUERP in the prescribed format, updated annually. An Italian entity must have appointed an RSPP. These derive from the same EU Framework Directive 89/391/EEC, but each member state implemented it with its own documentation and appointment rules, and the absence of the local instrument is a live exposure on day one of ownership.
Ask for the national document for each jurisdiction by name. If the response is a translated UK risk assessment, you have found something. This is the point at which most acquirers bring in global health and safety consultants, because verifying nine jurisdictions against nine different statutory tests is not a task for the UK legal team.
5. A competent person who leaves at completion
In smaller targets the health and safety function is frequently one individual holding it informally alongside another role, often an operations manager or a founder. Regulation 7 of the same Regulations requires the appointment of one or more competent persons, and in practice the knowledge sits with a named human rather than in a system.
Check who that person is and whether they are staying. If the competent person is on the earn-out and leaving at the end of it, the buyer inherits a function with no succession, no documentation and no continuity. This is straightforward to plan for and expensive to discover in month four.
6. Property liabilities inherited with the lease
Occupancy carries duties that transfer with the entity regardless of what the landlord maintains. Three are worth checking on every deal.
Is there a current fire risk assessment for each occupied premises, and has it been reviewed since the last fit-out. For buildings constructed or refurbished before 2000, is there an asbestos management survey and a written management plan. Where there are wet systems, cooling towers or infrequently used outlets, is there a legionella risk assessment with a monitoring record. Remediation on any of these is a capital item that belongs in the model, not a footnote.
The diligence request list
Six red flags, six things to ask for, and what each finding means commercially.
| Red flag | Request in the data room | What it means for the deal |
|---|---|---|
| Stale risk assessments | Every assessment with creation and review dates | Warranty and disclosure point. Remediation cost is modest but the pattern signals wider informality |
| Implausibly clean incident log | Raw register, not a summary, three years | Removes ability to price claims risk. Assume under-reporting and stress-test |
| Undisclosed enforcement | Independent register search before questionnaire | Direct negotiating position. Non-disclosure is a warranty breach |
| Missing local instruments | Named national document per jurisdiction | Often the largest item. Day-one exposure in each affected country |
| Departing competent person | Name, role, retention status, succession plan | Retention or transition cost. Plan into the first 100 days |
| Property duties | Fire, asbestos and legionella documentation per site | Capital remediation. Belongs in the model, not the schedule |
Where several of these appear together, the finding is rarely six separate problems. It is one problem: the target managed health and safety through individuals rather than through a system, and the system has to be built after completion by whoever now owns it.
What to do in the first 100 days
Do not commission a full audit on day one. Establish the baseline first, prioritise by jurisdiction and exposure, then build. Consolidating every entity onto a single register early is what makes the second year cheaper than the first, and it is where health and safety consultants and software do more together than either does alone: one set of findings, one owner per action, one evidence trail that survives the next transaction. Buyers who defer this typically repeat the whole exercise when they come to sell.
Where Arinite fits
Arinite supports acquirers and their advisers on both sides of a transaction, from pre-signing diligence through post-completion integration. We work with 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years, and our health and safety consultants work extensively with legal and finance and banking clients who buy and integrate businesses regularly. Where a target operates in multiple jurisdictions, our international health and safety consultants verify each entity against its own national requirements rather than a translated UK standard, and post-completion health and safety audits establish the baseline the integration plan is built on.
If you have a target under exclusivity and no view of what sits underneath it, a free gap analysis will tell you what to ask for and where the exposure is likely to be concentrated.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
